SUSE-RU-2026:23462-1: moderate: Recommended update for haproxy
SLE-UPDATES
null at suse.de
Wed Sep 9 13:46:25 UTC 2026
# Recommended update for haproxy
Announcement ID: SUSE-RU-2026:23462-1
Release Date: 2026-09-02T14:18:05Z
Rating: moderate
References:
Affected Products:
* SUSE Linux Micro 6.2
An update that can now be installed.
## Description:
This update for haproxy fixes the following issues:
* Released version 3.2.23:
* BUG/MINOR: flt-http-comp: Don't read next block to detect end of data
* BUG/MINOR: fcgi-app: allow explicit filter declaration with non-cache/non-compression filters
* BUG/MINOR: mux-h2: harden h2_dump_h2s_info() against potentially null h2s to sd
* BUG/MINOR: mqtt: fix PUBLISH flags validation that want all bits to be set
* BUG/MINOR: mqtt: connack parser uses wrong bit for SUBSCRIPTION_IDENTIFIERS_AVAILABLE
* BUG/MINOR: mqtt: connect parser uses wrong bit field for TOPIC_ALIAS_MAXIMUM
* BUG/MINOR: mqtt: connack parser returns MQTT_NEED_MORE_DATA on unknown property
* BUG/MINOR: cfgcond: make KQUEUE check for GTUNE_USE_KQUEUE not GTUNE_USE_EPOLL
* BUG/MINOR: auth: free user groups on error paths in userlist_postinit()
* BUG/MINOR: tools: fix memory leak in env_expand() error path
* BUG/MINOR: http-act: set-status() must check the response message, not the request
* BUG/MINOR: http-fetch: make http_first_req() check for HTTP first
* BUG/MINOR: http-fetch: fix smp_fetch_hdr_ip()'s handling of brackets for IPv6
* BUG/MINOR: ot: removed dead code in flt_ot_parse_cfg_str()
* BUG/MINOR: acme: NULL check on my_strndup()
* BUG/MINOR: config: Check buffer pool creation for failures
* BUG/MINOR: wurfl: fix memory leak of information list and patch strings at deinit
* BUG/MINOR: resolvers: accept fields at the response boundary
* BUG/MINOR: ssl/cli: fix frontend-not-found detection in 'show ssl sni -f'
* BUG/MINOR: ssl: isolate TLS session resumption per crt-list filter
* BUG/MINOR: ssl: apply tune.ssl.lifetime to TLS1.3 sessions on BoringSSL/AWS-LC
* BUG/MINOR: ssl: release the previous client cert reference at depth greater than 0
* BUG/MINOR: ssl: Fix leak of X509_NAME in traces
* BUG/MINOR: conn: Do not check 'sess_el' list on frontend connections in __trace_enabled
* BUG/MINOR: log: fix double-free error when error in parse_loger occurs
* BUG/MINOR: qpack: missing shift count check in qpack_get_varint() (UB)
* BUG/MINOR: spoe: check snprintf() return value in spoe_set_var/spoe_unset_var
* BUG/MINOR: payload: fix handshake length off-by-4 in ssl_hello_sni/alpn
* BUG/MINOR: server: fix off-by-one error when parsing and copying source port range
* BUG/MINOR: quic: avoid a division by zero in the BBR pacing interval
* BUG/MINOR: ssl: reject an embedded NUL in the full-DN ssl_*_dn() fetches
* BUG/MINOR: ssl: reject an embedded NUL in the ssl_*_dn(entry) fetches
* BUG/MINOR: mux-h2: strip the userinfo when deriving :authority for a server
* BUG/MINOR: debug: only dump the trace once in __BUG_ON_ONCE()
* BUG/MINOR: lb-chash: bound the walk when the saved cursor changed tree
* BUG/MINOR: connection: reserve the whole CRC32C TLV before saving its pointer
* BUG/MINOR: acme: restrict the permissions of the generated account key
* BUG/MINOR: ssl: reject server certificate names containing a NUL byte
* BUG/MINOR: mux-fcgi: sanitize the STDERR records before logging them
* BUG/MINOR: mux-fcgi: don't call fcgi_strm_destroy() on a NULL stream
* BUG/MINOR: hlua: use a local buffer to format the socket addresses
* BUG/MINOR: proxy: fix default-server leak on post-parsing cleanup
* BUG/MINOR: server: check strdup return value on server ID
* BUG/MINOR: cli: use the current argument to parse the FD spec in "show fd"
* BUG/MEDIUM: sink: do not create one implicit ring per logger copy
* BUG/MEDIUM: sink: initialize the settings of the implicit log server
* BUG/MEDIUM: cache: ignore cache on redundant origin/referer
* BUG/MEDIUM: sink: do not hold the sft lock around ring_dispatch_messages()
* BUG/MEDIUM: connection: fix an infinite loop in the fc_pp_tlv() fetch
* BUG/MEDIUM: mux-h1: close the connection on a short content-length
* BUG/MEDIUM: tools: make string encoding possible to fail instead of truncating
* BUG/MEDIUM: mux-fcgi: check the room left before appending the index
* BUG/MEDIUM: ssl: isolate TLS session resumption per authentication policy
* BUG/MEDIUM: ssl: isolate TLS session resumption per X509 server certificate
* BUG/MEDIUM: ssl: enforce tune.ssl.lifetime across TLS1.3 session renewals
* BUG/MEDIUM: ssl: Fix unprotected 'ssl_sock_choose_sni_ctx' calls
* BUG/MEDIUM: bwlim: fix a stick-table entry leak in shared mode
* BUG/MEDIUM: http: fix authority parsing for absolute-form URI with empty path
* BUG/MEDIUM: cache: do not release an entry under the cache read lock
* BUG/MEDIUM: cache: retain the primary or secondary entry only when detaching its row
* BUG/MEDIUM: hlua_fcn: ensure systematic bref cleanup for patref list iterator
* BUG/MEDIUM: lua: resume Channel:send() from the unsent part of the string
* BUG/MEDIUM: quic: prevent out-of-bound read on wrapping CRYPTO content
* BUG/MEDIUM: session: don't release a reversed connection twice on error
* BUG/MEDIUM: ssl: require a full-length AEAD tag when decrypting with AES-GCM
* BUG/MEDIUM: acme: don't delete a NULL token from the map
* BUG/MEDIUM: log: always reserve room for trailing 0 when using CBOR encoding helpers
* BUG/MEDIUM: http-ana: check the cookie rewrite result before moving the offsets
* BUG/MEDIUM: sock: bound the recvmsg() length when receiving old sockets
* BUG/MEDIUM: stick-tables: use the same bucket for string keys with a NUL
* BUG/MEDIUM: http-ana: don't crash on "keep-query" in a response redirect
* BUG/MEDIUM: spoe: clear the applet pointer when the applet fails to start
* BUG/MEDIUM: hpack: encode long methods and schemes using the long form
* BUG/MEDIUM: filter: Disable auto-close on channel during TCP payload filtering
* REGTESTS: converters: use connection: close in the has_ctl() test
* MINOR: sample: add new converter has_ctl() to detect control characters
* MINOR: log/tools: fix ambiguous comments for some log encoding helpers
* MEDIUM: mux-h2: don't report EOM on a short content-length message
* BUILD: ssl: avoid a potential null-dereference warning on OpenSSL 1.0.2
* BUILD: ssl: disable the TLS1.3 session timeout clamp on wolfSSL
* Released version 3.2.22:
* BUG/MINOR: server: fix check reuse-pool in srv_settings_cpy()
* BUG/MINOR: server: duplicate server alt_proto in srv_settings_cpy()
* BUG/MINOR: slz: avoid undefined shifts when building the word byte by byte
* BUG/MINOR: slz: fix the adler32 accumulators signedness on 32-bit
* BUG/MINOR: slz: do not append a block to an already finished stream
* BUG/MINOR: slz: use the exact switch cost for the last literals of a block
* BUG/MINOR: http-rules: fix release of a failed "set-cookie-fmt" redirect rule
* BUG/MINOR: htx: Transfer HTX_FL_EOM flag on success in htx_append_msg()
* BUG/MINOR: htx: Perform raw copy for messages of same size in htx_copy_msg()
* BUG/MINOR: http-htx: check the strdup() of the "lf-string" http reply argument
* BUG/MINOR: http-act: reject a negative capture id in the capture actions
* BUG/MINOR: http-act: restore the response buffer state in the early-hint action
* BUG/MINOR: http-act: fix a double free of the map reference on a parsing error
* BUG/MINOR: http-act: fix a double free of the regex on a rule parsing error
* BUG/MINOR: http-ana: fix a one-byte over-read in the client-side cookie parser
* BUG/MINOR: h2: don't use a block pointer to roll back a partial HTX conversion
* BUG/MINOR: h1: report the right error position on authority/host mismatch
* BUG/MINOR: http-htx: check the trash allocation in http_scheme_based_normalize()
* BUG/MINOR: http: fix an out-of-bounds read in http_get_host_port() on empty host
* BUG/MINOR: slz: do not read past the end of the input around the match loop
* BUG/MINOR: http-htx: fix the length moved when removing a header value
* BUG/MINOR: resolvers: do not index resolvers names in the proxies
* BUG/MINOR: sample: Fix bytes() when length it greater than remaining data
* BUG/MINOR: mux-h1: Don't delay send if message with c-l was fully sent
* BUG/MINOR: ssl: fix proxy lookup for show ssl sni
* BUG/MINOR: shctx: fix shctx_row_data_get() when offset exceeds a block
* BUG/MINOR: hlua: Apply socket timeout on server side only
* BUG/MINOR: http-conv: Make url-dec failed if no space for trailing null byte
* BUG/MINOR: stream: Fix custom max-retries initialization when setting backend
* BUG/MINOR: stream: Fix custom timeouts initialization when setting backend
* BUG/MINOR: sample: Fix a possible underflow on be2hex for large chunk size
* BUG/MINOR: mux_quic: prevent multiple STOP_SENDING emission per stream
* BUG/MEDIUM: server: Properly check for streams before deletion
* BUG/MEDIUM: slz: bound the bits wasted by the 9-bit literals
* BUG/MEDIUM: sample: reject the deprecated protobuf group wire types
* BUG/MEDIUM: peers: check the available room before encoding dict values
* BUG/MEDIUM: http-fetch: reject a negative capture id in capture.{req,res}.hdr
* BUG/MEDIUM: http-fetch: don't parse a non-HTTP check buffer as an HTX message
* BUG/MEDIUM: mux-h1: Always adjust case for all outgoing headers as expected
* BUG/MEDIUM: proxy: protect "show servers ..." against server deletion
* BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for ltrim()
* BUG/MEDIUM: sample: Adjust sample size capacity after pointer shift for bytes()
* BUG/MEDIUM: protobuf: fix nested path bypass in field lookup
* BUG/MEDIUM: protobuf: adjust sample size capacity after pointer shift
* BUG/MEDIUM: ssl-gencert: Don't forget to free memory when done
* BUG/MEDIUM: stats: Ensure that Origin is valid on POSTs
* BUG/MEDIUM: cache: reattach the row when a secondary entry is incomplete
* BUG/MEDIUM: stats: subject "stats admin" accesses to "stats scope" filtering
* BUG/MEDIUM: applet: Reenable reads in applet context if requesting a connection
* BUG/MEDIUM: fd: Fix a deadlock when closing other tgroups fds
* BUG/MEDIUM: h3: fix parser desync on error with multiple frames
* MINOR: server: improve parsing error for server-template
* MINOR: shctx: clamp shctx_row_data_get() reads against the offset
* MINOR: stats: factor the proxy vs scope check into its own function
* MEDIUM: stream: Introduce stream_set_srv_target()
* BUG/MAJOR: ssl/ocsp: lock the OCSP response around reads in the stapling callback
* CLEANUP: slz: clarify that the size promise applies to the stream, not to a call
* CLEANUP: slz: fix the documented worst case size of flush() and finish()
* REORG: h1-htx: Move h1 headers map in h1-htx
* REORG: stconn: Move sc_chk_rcv() from sc_strm.h to stconn.c
* REGTESTS: protobuf: add regression test for nested vs flat paths
* DOC: stats: Document that stats admin is vulnerable to a CSRF attack
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.2
zypper in -t patch SUSE-SL-Micro-6.2-1591=1
## Package List:
* SUSE Linux Micro 6.2 (aarch64 ppc64le s390x x86_64)
* haproxy-3.2.23+git0.1feef49b0-160000.1.1
* haproxy-debugsource-3.2.23+git0.1feef49b0-160000.1.1
* haproxy-debuginfo-3.2.23+git0.1feef49b0-160000.1.1
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260909/423a1b83/attachment-0001.htm>
More information about the sle-updates
mailing list